Firewall

Open the machine → Firewall tab.

How firewall groups work

A firewall group is a reusable set of rules that you attach to one or more machines in the same project. Write the rules once, apply them to every web server you own; edit the group later and every attached machine picks up the change.

Each rule has:

Default policies

The defaults are the important part, and they are not symmetric:

• Incoming: DROP. Anything you don't explicitly allow is blocked. If there are no incoming rules at all, all inbound traffic is blocked.
• Outgoing: ACCEPT. Anything you don't explicitly restrict is allowed. If there are no outgoing rules, all outbound traffic is permitted.

So the practical work is adding one incoming rule per service you expose: TCP 22 for SSH, TCP 80 and 443 for a website, and so on.

Warning

Always keep an incoming rule for SSH (TCP 22) or RDP (TCP 3389) before you apply a group, or you'll lock yourself out. If it happens, the browser console still works — it doesn't go through the firewall.

Apply the rules

Toggle a group On or Off for this machine, then click Apply Changes. Rules take effect live, with no reboot and no dropped connections beyond the ones you just blocked.

The tab shows how many groups are active and how many machines share each group, so you can see the blast radius before you edit one.

What this firewall does not do

Important

This firewall filters packets at the machine. It cannot stop a volumetric DDoS attack — by the time the traffic reaches your server, the bandwidth is already consumed, and sustained flooding may cause us to null-route the machine to protect the rest of the network.

For attack traffic you need filtering further upstream: see DDoS Mitigation for Edge ACL rules and AntiDDoS Premium, which drop traffic at the network edge before it reaches you.

Tip

Prefer specific sources over 0.0.0.0/0 wherever you can. Restricting SSH to your office or VPN range removes almost all brute-force noise from a server's logs.